Remote Penetration Tester: Web/API Security & Compliance

Connsci; Gaithersburg (MD); On-site; USD 120,000 - 160,000; Full time

Job summary

Connsci seeks a Penetration Tester to join our growing organization. The role supports a government program and covers penetration testing, vulnerability and compliance testing, web application testing, API testing, and audit/reporting functions.

Travel to client sites in Florida and DC area is required as needed, with a preference for local candidates. The candidate will validate security controls per NIST CSF/NIST 800-53, perform fuzzing and BOLA testing on APIs, and document findings for

Qualifications

• Bachelor's degree in Cybersecurity, Information Systems, or related field.
• At least 5 years of experience in penetration testing including web application and API testing.
• At least 2 years supporting audit, compliance, or oversight with audit-ready documentation, evidence, and reports.
• At least 2 years with the NIST Cybersecurity Framework including NIST 800-53.
• At least one cybersecurity certification such as CISSP, CISA, CISM, CCE, CFCE, GCFE, or CEH.

Responsibilities

• Conduct authenticated vulnerability scans and compliance evaluations across networks, systems, endpoints, and cloud platforms.
• Perform web application testing using OWASP Top 10 and industry best practices.
• Conduct authenticated/unauthenticated scans using Burp Suite and OWASP ZAP.
• Identify vulnerabilities such as injection flaws, authentication weaknesses, session mismanagement, and data exposure.
• Evaluate REST/GraphQL APIs for authentication, authorization, and input validation weaknesses.
• Perform penetration testing (internal and external) to simulate adversaries and assess defenses.
• Document findings, prepare audit evidence, and provide recommendations to improve governance, risk, and compliance.
• Collaborate with Agency OIGs and IT/security teams to ensure findings are actionable.
• Location/Travel: primarily remote with travel to Florida and DC metro region as needed.

Skills

Penetration testing

Web application testing

API testing

NIST CSF

Audit support

Education

Bachelor's degree in Cybersecurity, Information Systems, or related field

Master's degree in Cybersecurity, IT, or CS (preferred)

Tools

Burp Suite

OWASP ZAP

Job description

Connsci seeks a Penetration Tester to join our growing organization. The role supports a government program and covers penetration testing, vulnerability and compliance testing, web application testing, API testing, and audit/reporting functions.

Travel to client sites in Florida and DC area is required as needed, with a preference for local candidates. The candidate will validate security controls per NIST CSF/NIST 800-53, perform fuzzing and BOLA testing on APIs, and document findings for